EcoStruxure™ Control Expert

EIO0000001714 12/2018

EcoStruxure™
Control Expert
PLC Simulator
(Original Document)

12/2018
EIO0000001714.07

www.schneider-electric.com
 The information provided in this documentation contains general descriptions and/or technical
characteristics of the performance of the products contained herein. This documentation is not
intended as a substitute for and is not to be used for determining suitability or reliability of these
products for specific user applications. It is the duty of any such user or integrator to perform the
appropriate and complete risk analysis, evaluation and testing of the products with respect to the
relevant specific application or use thereof. Neither Schneider Electric nor any of its affiliates or
subsidiaries shall be responsible or liable for misuse of the information contained herein. If you
have any suggestions for improvements or amendments or have found errors in this publication,
please notify us.
You agree not to reproduce, other than for your own personal, noncommercial use, all or part of
this document on any medium whatsoever without permission of Schneider Electric, given in
writing. You also agree not to establish any hypertext links to this document or its content.
Schneider Electric does not grant any right or license for the personal and noncommercial use of
the document or its content, except for a non-exclusive license to consult it on an "as is" basis, at
your own risk. All other rights are reserved.
All pertinent state, regional, and local safety regulations must be observed when installing and
using this product. For reasons of safety and to help ensure compliance with documented system
data, only the manufacturer should perform repairs to components.
When devices are used for applications with technical safety requirements, the relevant
instructions must be followed.
Failure to use Schneider Electric software or approved software with our hardware products may
result in injury, harm, or improper operating results.
Failure to observe this information can result in injury or equipment damage.
© 2018 Schneider Electric. All rights reserved.

2 EIO0000001714 12/2018
 Table of Contents

Safety Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
About the Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Chapter 1 Simulating a PLC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
PLC Simulator Cyber Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Loading a Project in the Simulator. . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Simulator Icon in the Toolbar. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Chapter 2 Differences Between the Simulator and a Real CPU . . . 19
Limitations of the PLC Simulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
System Bits and System Words . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Chapter 3 Menu Commands and Dialog Boxes in the PLC Simulator 37
Simulator Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Simulator Control for Unknown CPU . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Simulator Control for Modicon M580 CPU . . . . . . . . . . . . . . . . . . . . . 42
Simulator Control for Modicon M580 Safety CPU . . . . . . . . . . . . . . . . 44
Memory Card for Modicon M580 CPU . . . . . . . . . . . . . . . . . . . . . . . . 47
Simulator Control for Modicon Quantum CPU. . . . . . . . . . . . . . . . . . . 51
Simulator Control for Modicon Quantum Safety CPU . . . . . . . . . . . . . 54
Simulator Control for Modicon Premium CPU . . . . . . . . . . . . . . . . . . . 57
Simulator Control for Modicon M340 CPU . . . . . . . . . . . . . . . . . . . . . 59
Memory Card for Modicon M340 CPU . . . . . . . . . . . . . . . . . . . . . . . . 62
Simulator Control for Modicon Momentum CPU . . . . . . . . . . . . . . . . . 66
Event Dialog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Clear . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Power Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Timing (simulator) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Processor Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Priority of the Simulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Data in the User Task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

EIO0000001714 12/2018 3
 Minimal Sample Time. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Info . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Ending the Simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

4 EIO0000001714 12/2018
 Safety Information

Important Information

NOTICE
Read these instructions carefully, and look at the equipment to become familiar with the device
before trying to install, operate, service, or maintain it. The following special messages may appear
throughout this documentation or on the equipment to warn of potential hazards or to call attention
to information that clarifies or simplifies a procedure.

EIO0000001714 12/2018 5
PLEASE NOTE
Electrical equipment should be installed, operated, serviced, and maintained only by qualified
personnel. No responsibility is assumed by Schneider Electric for any consequences arising out of
the use of this material.
A qualified person is one who has skills and knowledge related to the construction and operation
of electrical equipment and its installation, and has received safety training to recognize and avoid
the hazards involved.

BEFORE YOU BEGIN

Do not use this product on machinery lacking effective point-of-operation guarding. Lack of
effective point-of-operation guarding on a machine can result in serious injury to the operator of
that machine.

WARNING
UNGUARDED EQUIPMENT
 Do not use this software and related automation equipment on equipment which does not have
point-of-operation protection.
 Do not reach into machinery during operation.
Failure to follow these instructions can result in death, serious injury, or equipment damage.

This automation equipment and related software is used to control a variety of industrial processes.
The type or model of automation equipment suitable for each application will vary depending on
factors such as the control function required, degree of protection required, production methods,
unusual conditions, government regulations, etc. In some applications, more than one processor
may be required, as when backup redundancy is needed.
Only you, the user, machine builder or system integrator can be aware of all the conditions and
factors present during setup, operation, and maintenance of the machine and, therefore, can
determine the automation equipment and the related safeties and interlocks which can be properly
used. When selecting automation and control equipment and related software for a particular
application, you should refer to the applicable local and national standards and regulations. The
National Safety Council's Accident Prevention Manual (nationally recognized in the United States
of America) also provides much useful information.
In some applications, such as packaging machinery, additional operator protection such as point-
of-operation guarding must be provided. This is necessary if the operator's hands and other parts
of the body are free to enter the pinch points or other hazardous areas and serious injury can occur.
Software products alone cannot protect an operator from injury. For this reason the software
cannot be substituted for or take the place of point-of-operation protection.
Ensure that appropriate safeties and mechanical/electrical interlocks related to point-of-operation
protection have been installed and are operational before placing the equipment into service. All
interlocks and safeties related to point-of-operation protection must be coordinated with the related
automation equipment and software programming.

6 EIO0000001714 12/2018
 NOTE: Coordination of safeties and mechanical/electrical interlocks for point-of-operation
protection is outside the scope of the Function Block Library, System User Guide, or other
implementation referenced in this documentation.

START-UP AND TEST

Before using electrical control and automation equipment for regular operation after installation,
the system should be given a start-up test by qualified personnel to verify correct operation of the
equipment. It is important that arrangements for such a check be made and that enough time is
allowed to perform complete and satisfactory testing.

WARNING
EQUIPMENT OPERATION HAZARD
 Verify that all installation and set up procedures have been completed.
 Before operational tests are performed, remove all blocks or other temporary holding means
used for shipment from all component devices.
 Remove tools, meters, and debris from equipment.
Failure to follow these instructions can result in death, serious injury, or equipment damage.

Follow all start-up tests recommended in the equipment documentation. Store all equipment
documentation for future references.
Software testing must be done in both simulated and real environments.
Verify that the completed system is free from all short circuits and temporary grounds that are not
installed according to local regulations (according to the National Electrical Code in the U.S.A, for
instance). If high-potential voltage testing is necessary, follow recommendations in equipment
documentation to prevent accidental equipment damage.
Before energizing equipment:
 Remove tools, meters, and debris from equipment.
 Close the equipment enclosure door.
 Remove all temporary grounds from incoming power lines.
 Perform all start-up tests recommended by the manufacturer.

EIO0000001714 12/2018 7
OPERATION AND ADJUSTMENTS
The following precautions are from the NEMA Standards Publication ICS 7.1-1995 (English
version prevails):
 Regardless of the care exercised in the design and manufacture of equipment or in the selection
and ratings of components, there are hazards that can be encountered if such equipment is
improperly operated.
 It is sometimes possible to misadjust the equipment and thus produce unsatisfactory or unsafe
operation. Always use the manufacturer’s instructions as a guide for functional adjustments.
Personnel who have access to these adjustments should be familiar with the equipment
manufacturer’s instructions and the machinery used with the electrical equipment.
 Only those operational adjustments actually required by the operator should be accessible to
the operator. Access to other controls should be restricted to prevent unauthorized changes in
operating characteristics.

8 EIO0000001714 12/2018
 About the Book

At a Glance

Document Scope
This document describes the PLC Simulator for EcoStruxure™ Control Expert.

Validity Note
This document is valid for EcoStruxure™ Control Expert 14.0 or later.

Related Documents

Title of documentation Reference number

EcoStruxure™ Control Expert, System Bits and EIO0000002135 (English),
Words, Reference Manual EIO0000002136 (French),
EIO0000002137 (German),
EIO0000002138 (Italian),
EIO0000002139 (Spanish),
EIO0000002140 (Chinese)
EcoStruxure™ Control Expert, Program Languages 35006144 (English),
and Structure, Reference Manual 35006145 (French),
35006146 (German),
35013361 (Italian),
35006147 (Spanish),
35013362 (Chinese)
Modicon M580, Safety System Planning Guide QGH60283 (English),
QGH60284 (French),
QGH60285 (German),
QGH60286 (Spanish),
QGH60287 (Italian),
QGH60288 (Chinese)

You can download these technical publications and other technical information from our website
at www.schneider-electric.com/en/download.

EIO0000001714 12/2018 9
10 EIO0000001714 12/2018
 EcoStruxure™ Control Expert
Simulating a PLC
EIO0000001714 12/2018

Chapter 1
Simulating a PLC

Simulating a PLC

Overview
This chapter describes simulating a PLC.

What Is in This Chapter?

This chapter contains the following topics:
Topic Page
Introduction 12
PLC Simulator Cyber Security 13
Loading a Project in the Simulator 14
Simulator Icon in the Toolbar 17

EIO0000001714 12/2018 11
Simulating a PLC

Introduction

Installation
The simulator is automatically installed with Control Expert.

Area of Use
The simulator allows you to simulate a CPU.
The use of Breakpoints, Stepping and the GoTo function enables you to test your user program in
the simulated CPU.

Structure of the Simulator

The Simulator Dialog (see page 38) provides the following indications:
 Type of simulated CPU.
 Current status of the simulated CPU.
 Name of the loaded project.
 IP address and DNS name of the host PC for the simulator.
 IP addresses and DNS names of connected client PCs.
 Dialog box to simulate IO events.
 Reset button to simulate a cold start.
 Power Cycle button to simulate a warm start.
 Shortcut menu (right mouse button) to control the simulator.

The Simulator symbol shown in the task bar offers the following features:
 Display of the current status of the simulated PLC (see page 17).
 QuickInfo (Tooltips) shows the IP address of the host PC for the simulator, the used port number
and the name of the loaded project.
 Shortcut menu (right mouse button) to control the simulator.

12 EIO0000001714 12/2018
 Simulating a PLC

PLC Simulator Cyber Security

At a Glance
PLC simulator fits the Cyber Security requirements.
These two rules are applied:
 The PLC simulator only starts with an application inside.
 The PLC simulator forbids to upload an application in monitoring mode.

PLC Simulator Only Starts with an Application Inside

The PLC Simulator Option Panel supplies a new check box Use default application to start
simulator (enforce security) and a new field to give the application path.
If Use default application to start simulator (enforce security) box is checked, an application with
password should be accessible by the path given in the field, this is the default option.
If the option is unchecked, a message is displayed to inform that the PLC Simulator use is not
secured on its 502 Port.
At first start of PLC Simulator, the box is checked but the path is empty. A popup message informs
that:
 A valid Control Expert application is mandatory to start PLC Simulator.
 To enforce security, it is necessary to use an Application Password.

NOTE: Password protected application is necessary to enforce security on Ethernet port of

computer which is by default port 502.
When PLC Simulator is started from Control Expert (menu PLC → Connect) or from Windows
menus with Use default application to start simulator (enforce security) box checked:
 If there is no application with password in the PLC simulator or application path is not valid, the
Simulator Panel Options windows pops up and PLC simulator will not start unless a valid path
is set or the option is unchecked.
 If application path is valid, the PLC simulator starts, without displaying the option panel.

PLC Simulator Forbid to Upload an Application in Monitoring Mode

In Monitoring mode the PLC → Transfer Project from PLC option is grayed. The related icon is
grayed too.
As a result, the PLC Project from PLC simulator cannot be uploaded.

EIO0000001714 12/2018 13
Simulating a PLC

Loading a Project in the Simulator

Introduction
The process for loading a project to the simulator is identical in principle to loading a project on a
real PLC.

Loading a Project
Loading a project in the simulator

Step Action
1 In Control Expert, enable the simulator mode using the menu command PLC → Simulation mode
or the symbol

on the toolbar:
2 Execute the menu command Rebuild → Rebuild All Project.
3 Create a connection to the simulator using the menu command PLC → Connect, see also
Creating a Connection, page 15.
Result:
 The simulator icon (see page 17) appears in the toolbar:

 see also Possible Error Messages, page 16

Note: It is standard procedure for the simulator to be installed on the same PC as Control Expert
(Local Host). The project can also be loaded on a simulator in another PC via a TCP/IP
connection.
4 Execute the menu command PLC → Transfer project to PLC.
Result:
A transfer dialog box appears.

14 EIO0000001714 12/2018
 Simulating a PLC

Step Action
5 Press the Transfer button.
Result: The project is loaded on the simulator and the simulator icon looks as follows in the
toolbar:

6 Select the menu command PLC → Start.

Result: The project is launched on the simulator and the simulator icon looks as follows in the
toolbar:

Transferring Safety/Non-Safety Projects

It is not possible to transfer a non-safety project after you have transferred a safety project to the
PLC simulator and vice versa.
In this case you first have to clear the PLC simulator. See Clear, page 69.

Control Expert XLS Password Protection

Safety projects built with Control Expert XLS are password protected.
If a safety project has been transferred to the simulator and you try to connect Control Expert XLS
to the simulator, you are asked to enter the password.
You are asked to enter the password either if no project is opened in Control Expert XLS or if a
different one is opened.
NOTE: To remove the currently loaded project from the simulator memory you can use the Clear
menu command. See Clear, page 69.
For further information on password protection of safety projects please refer to the chapter
Application Protection (see Modicon M580, Safety System Planning Guide).

Creating a Connection
It is standard procedure for the simulator to be installed on the same PC as Control Expert (Local
Host). When the menu command PLC → Connect is selected, a connection to the Local Host PC
on the default port 502 (Schneider Port) is automatically created. The project can also be loaded
on a simulator in another PC via a TCP/IP connection or on a simulator running on a different port.
In this case you must specify the TCP/IP address and port number of the target PC in the Loading
a project procedure before carrying out step 3 (creating a connection).
Then select the Control Expert menu command PLC → Set Address, and in the Simulator text box
Address enter the TCP/IP address and the optional port number of the target PC (i.e.:
139.158.106.127:123 where 123 is the port number). Then continue with step 3.

EIO0000001714 12/2018 15
Simulating a PLC

If you want to load the project in the Local Host PC simulator running on default port 502
(Control Expert and simulator on the same PC), you do not have to carry out this step as the Local
Host PC address and port number is automatically entered.
Representation of the default dialog box:

Possible Error Messages

The following error messages can occur when launching the simulator:

Error message Cause Removal

A simulator is already running! The simulator is already active. Confirm the error message with OK and
Only one simulator can be active. use the simulator that is already active.
Version information from xxx invalid file in the simulator Reinstall Control Expert after
cannot be read (err=0)! directory uninstalling it.
The DLL xxx is incompatible invalid file in the simulator Reinstall Control Expert after
(...)! directory uninstalling it.
At least one Simulator DLL is invalid file in the simulator Reinstall Control Expert after
incompatible. Simulation not directory uninstalling it.
possible!

Exiting the Simulator

The procedure for exiting the simulator is as follows:

Step Action
1 Call the menu command Exit Simulation from the shortcut menu for the simulator icon in the
toolbar or the simulator dialog box.
Result: The simulator is closed.

16 EIO0000001714 12/2018
 Simulating a PLC

Simulator Icon in the Toolbar

Introduction
After launching the simulators the simulator icon appears in the toolbar. This icon identifies the
active simulator and displays the different states of the simulated PLC.

General Structure
The simulator icon is composed according to the following rules.
The background color represents the basic state.

Example Color Description

green normal operating mode

yellow PLC in HALT state

red PLC in ERROR state

A frame around the icon shows the active debug mode

Example Color Description

blue Debug mode is active, i.e. at least one breakpoint is set in
the project, or there is at least one user task in debug mode.

The inner symbol shows the current PLC state, such as NOCONF, IDLE, STOPPED, RUN.

Symbol The simulated PLC is in state... Description

NOCONF (no configuration) No user project loaded or the loaded project is invalid or
removed with the Clear command.

IDLE The project loaded on the PLC has not been started or reset
with the Reset command button.

STOPPED No project is running.

RUN A project with at least one task is running.

EIO0000001714 12/2018 17
Simulating a PLC

The color of the inner symbol shows the connection state.

Example Color Description

black No TCP/IP client is connected.

red At least one TCP/IP client is connected.

Error States
Meaning of the symbols

Symbol The simulated PLC is in state... Description

HALT An error has occurred in the project. The simulated PLC
must be re-initialized or reset using the Reset command
button.
ERROR An fatal error has occurred in the project. This means
communication is no longer possible. The simulated PLC
must be reset using the Reset command button.

Internal States
The following symbols represent temporary internal states which should not be seen normally. It is
not possible to recover from these states, so the PLC simulator must be closed and restarted
again.

Symbol The simulated PLC is in state... Description

POWER OFF An internal error has occurred during the
simulation of a PLC reset or power cycle.

INIT An internal error has occurred during the

initialization of the PLC simulator.

UNKNOWN The PLC simulator has entered an

unknown state.

18 EIO0000001714 12/2018
 EcoStruxure™ Control Expert
Differences
EIO0000001714 12/2018

Chapter 2
Differences Between the Simulator and a Real CPU

Differences Between the Simulator and a Real CPU

Overview
This chapter describes the difference between the simulator and a real PLC.

What Is in This Chapter?

This chapter contains the following topics:
Topic Page
Limitations of the PLC Simulator 20
System Bits and System Words 23

EIO0000001714 12/2018 19
Differences

Limitations of the PLC Simulator

General
General limitations
 The PLC simulator simulates a complete project with its user tasks. However, the runtime
behavior of the simulator cannot be compared to that of a real PLC and cannot be used to draw
conclusions about the behavior of a real PLC. This includes Multitasking behavior and time
information.
 The PLC Simulator does not support any form of I/O. Although the simulation contains project
components for I/Os, they are not processed by the PLC simulator. Inputs and outputs can only
be accessed via the project or via the Control Expert online functions (read, write, force,
animate, ...).
 With the PLC simulator I/O events can not be triggered by setting/forcing %I bits.
 For limitations concerning the memory card please refer to Memory Card for Modicon M580
CPU (see page 47) and Memory Card for Modicon M340 CPU (see page 62).
 The PLC Simulator does not support any Hot Standby feature.

PLC OS System Services

The PLC simulator supports the most PLC OS system services on a variety of platforms. These
services are only implemented as dummy services.
This means that functions and function blocks can be used in the loaded project, but they do not
work as expected and/or they return an error message.
This mainly affects functions and function blocks that accessed special platforms, such as I/O
blocks, communication and hardware specific functions.
The following PLC OS system services are supported:
 diagnostics functions
 functions to read the date and time
 propagation delay time
 object access (except network variables)
 Premium DFBs
 SFC

The following PLC OS system services are not supported:

 closed loop control (CLC)
 Fip IO
 BusX IO
 Quantum IO
 configuration
 communication
 functions to set the date and time

20 EIO0000001714 12/2018
 Differences

Memory Structure
The different PLC families vary in memory structure.
For detailed information about memory alignment refer to chapter DDT: Mapping rules.
(see EcoStruxure™ Control Expert, Program Languages and Structure, Reference Manual)
For detailed information about storage principles and memory structure refer to chapter Application
Memory structure (see EcoStruxure™ Control Expert, Program Languages and Structure,
Reference Manual).
NOTE: PLC Simulator is a 16 bits application, whatever PLC in application is (Quantum, Premium,
M580...). This is why you must rebuild your application when you switch from real PLC to
Simulator.

WARNING
UNINTENDED EQUIPMENT OPERATION
Improper data mapping will occur where memory structures are different. When managing data
exchanges between M340, M580 or Momentum projects and Premium or Quantum projects,
ensure that the structure of the exchanged data has identical alignments (see EcoStruxure™
Control Expert, Program Languages and Structure, Reference Manual).
Otherwise, the data will not be exchanged properly.
Failure to follow these instructions can result in death, serious injury, or equipment damage.

Communication
Communication limitations
 The PLC simulator only supports TCP/IP based communication (Schneider Port 502). In other
cases a Modbus error is returned.
 Modbus, Modbus Plus or Uni-TE are not supported by the PLC simulator.
 The PLC simulator does not support communication to other PCs or PLC simulators, neither
remote nor local.
 The PLC simulator has no communication timeout.
 Communication network, such as Uni-Telway, Ethway, Fipway, Modbus, Modbus Plus, etc., are
not supported by the PLC simulator.
The PLC simulator supports the following native Modbus commands:

Function Code (in hex) Description

01 Read Coil Status (0x)
02 Read Input Status (1x)
03 Read Holding Registers (4x)
04 Read Input Registers (3x)
05 Force Single Coil (0x)

EIO0000001714 12/2018 21
Differences

Function Code (in hex) Description

06 Preset Single Register (4x)
0F Force Multiple Coils (0x)
10 Preset Multiple Registers (4x)
16 Mask Write Registers (4x)

Mapping a %MW to a Boolean Element

Regarding the use of %MW mapped on a boolean element in structured data type, the PLC simulator
and a real PLC behave different.
When a %MW is mapped on a boolean element in structured data type, only the first row is animated
by the PLC simulator. On a real PLC both rows (zero and one) are animated. Row one is used to
get the information about the history value.

Control Expert XLS Safety Project Limitations

The following limitations apply to the PLC simulator working with safety projects built with
Control Expert XLS:
 The PLC simulator has no double code execution of the logic and comparison of the results. It
only simulates the logic but not the safety behavior of the PLC.
 It is not possible to transfer a non-safety project after you have transferred a safety project to
the PLC simulator and vice versa.
In this case you first have to clear the PLC simulator. See Clear, page 69.

Debugging Limitations
The PLC simulator could enter HALT state when executing the Step Info or Step Over debugging
command in textual languages.
If the current element is a complex instruction (i.e. copying a huge array from one variable to
another), the execution of this instruction takes a very long time, because it will be executed in
single step mode on the PLC simulator.
Setting a breakpoint on the next instruction and executing the Go command avoids this problem.

System Word %SW125

In case of division by 0 the %SW125 is set to:
 16#DEF0 (division by 0) for legacy Quantum PLC and for the PLC simulator
 16#DEF2: (arithmetic error) for Quantum HE (high end) PLCs

22 EIO0000001714 12/2018
 Differences

System Bits and System Words

System Bits
The following subsets of %S system bits (see EcoStruxure™ Control Expert, System Bits and
Words, Reference Manual) are supported:

Bit Function Description

Symbol
%S0 cold start Normally at 0, this bit is set to 1 by:
COLDSTART  power restoration with loss of data (battery fault)
 the user program
 the termina,
 a change of cartridge

This bit is set to 1 during the first complete restored cycle of the PLC
either in RUN or in STOP mode. It is reset to 0 by the system before
the following cycle.
NOTE: When %S0 is set to 1, the messages in the diagnostic buffer
are deleted.
NOTE: %S0 is not set to 1 using Reset with the PLC simulator (in
contrast to a real PLC).
%S0 is not always set in the first scan of the PLC. If a signal set for
every start of the PLC is needed, %S21 should be used instead.
%S1 warm restart Normally at 0, this bit is set to 1 by :
WARMSTART (not for safety PLCs)  power restoration with data save
 the user program
 the terminal
 action on change of cartridge

It is reset to 0 by the system at the end of the first complete cycle and
before the outputs are updated.
%S1 is not always set in the first scan of the PLC. If a signal set for
every start of the PLC is needed, %S21 should be used instead.
%S4 time base 10 ms An internal timer regulates the change in status of this bit.
TB10MS (not for safety PLCs) It is asynchronous in relation to the PLC cycle. Graph:

%S5 time base 100 ms Similar wave structure as %S4

TB100MS (not for safety PLCs)
%S6 time base 1 s Similar wave structure as %S4
TB1SEC (not for safety PLCs)
%S7 time base 1 min Similar wave structure as %S4
TB1MIN (not for safety PLCs)

EIO0000001714 12/2018 23
Differences

Bit Function Description

Symbol
%S11 watchdog overflow Normally at 0, this bit is set to 1 by:
WDG  power restoration with data save
 the user program
 the terminal
 action on change of cartridge.

It is reset to 0 by the system at the end of the first complete cycle and
before the outputs are updated.
%S12 PLC in RUN This bit is set to 1 by the system when the PLC is in RUN.
PLCRUNNING It is set to 0 by the system as soon as the PLC is no longer in RUN
(STOP, INIT, etc.).
%S13 first cycle after switching to Normally set to 0, this is set to 1 by the system during the first cycle
1RSTSCANRUN RUN of the master task after the PLC is set to RUN.
%S15 character string fault Normally set to 0, this bit is set to 1 when the destination zone for a
STRINGERROR (not for safety PLCs) character string transfer is not of sufficient size (including the number
of characters and the end of string character) to receive this character
string.
The application stops in error state if the %S78 bit has been to set to
1.
This bit must be reset to 0 by the application.
%S17 rotate or shift output normally at 0
CARRY During a rotate or shift operation, this bit takes the state of the
outgoing bit.
%S18 overflow or arithmetic error Normally set to 0, this bit is set to 1 in the event of a capacity overflow
OVERFLOW if there is:
 a result greater than + 32 767 or less than - 32 768, in single length
 a result greater than + 65 535, in unsigned integer
 a result greater than + 2 147 483 647 or less than - 2 147 483 648,
in double length
 result greater than +4 294 967 296, in double length or unsigned
integer
 real values outside limits
 division by 0
 the root of a negative number
 forcing to a non-existent step on a drum
 stacking up of an already full register, emptying of an already
empty register
It must be tested by the user program after each operation where
there is a risk of overflow, and then reset to 0 by the user if there is
indeed an overflow.
When the %S18 bit switches to 1, the application stops in error state if
the %S78 bit has been set to 1.

24 EIO0000001714 12/2018
 Differences

Bit Function Description

Symbol
%S19 task period overrun Normally set to 0, this bit is set to 1 by the system in the event of a
OVERRUN (periodical scanning) time period overrun (i.e. task execution time is greater than the period
defined by the user in the configuration or programmed into the %SW
word associated with the task). The user must reset this bit to 0. Each
task manages its own %S19 bit.
%S20 index overflow Normally set to 0, this bit is set to 1 when the address of the indexed
INDEXOVF (not for safety PLCs) object becomes less than 0 or exceeds the number of objects
declared in the configuration.
In this case, it is as if the index were equal to 0.
It must be tested by the user program after each operation where
there is a risk of overflow, and then reset to 0 if there is indeed an
overflow.
When the %S20 bit switches to 1, the application stops in error state if
the %S78 bit has been set to 1.
%S30 activation/deactivation of Normally set to 1. The master task is deactivated when the user sets
MASTACT the master task the bit to 0.
(not for safety PLCs) This bit is taken into consideration by the system at the end of each
MAST task cycle.
%S31 activation/deactivation of Normally set to 1 when the user creates the task. The task is
FASTACT the fast task deactivated when the user sets the bit to 0.
(not for safety PLCs)
%S32 activation/deactivation of Normally set to 1 when the user creates the task. The auxiliary task is
AUX0ACT to the auxiliary tasks 0-3 deactivated when the user sets the bit to 0.
%S35 (not for safety PLCs)
AUX3ACT
%S38 enabling/inhibition of Normally set to 1. Events are inhibited when the user sets the bit to 0.
ACTIVEVT events
(not for safety PLCs)
%S39 saturation in event This bit is set to 1 by the system to indicate that one or more events
EVTOVR processing cannot be processed following saturation of the queues.
(not for safety PLCs) The user must reset this bit to 0.
%S62 memory protect OFF This bit is the image of the key switch on legacy and high end
MEMPROTOFF (not for safety PLCs) Quantum PLCs.
%S65 card disable (Mirano) Set to 1 by the user to disable access to the card. The system will
CARDIS (not for safety PLCs) detect a rising edge on this bit. When current access is finished (for
example application save in progress), then the access LED will be off
indicating that extraction is possible. The user has to reset the bit after
extracting the card.
%S68 state of the processor This bit is used to check the operating state of the backup battery for
PLCBAT battery saving data and the program in RAM:
 set to 0: battery present and operational
 set to 1: battery missing or non-operational

EIO0000001714 12/2018 25
Differences

Bit Function Description

Symbol
%S76 configured diagnostics This bit is set to 1 by the system when the diagnostics option has been
DIAGBUFFCONF buffer configured. Then, a diagnostics buffer for storage of errors found by
diagnostics DFBs is reserved.
This bit is read-only.
%S77 full diagnostics buffer This bit is set to 1 by the system when the buffer that receives errors
DIAGBUFFFULL from the diagnostics function blocks is full.
This bit is read-only.
%S78 stop in the event of error Normally at 0, this bit can be set to 1 by the user, to program a PLC
HALTIFERROR stop on application fault: %S15, %S18, %20.
%S80 reset message counters Normally set to 0, this bit can be set to 1 by the user to reset the
RSTMSGCNT message counters %SW80 to %SW86.
%S94 saving adjustment values Normally at 0, this bit can be set to 1 by the user to replace the initial
SAVECURRVAL (not for safety PLCs) values of the declared variables with a ‘Save’ attribute (e.g.: DFB
variables) with the current values.
For Modicon M340, on a %S94 rising edge, the internal RAM and the
memory card content are different (%S96 = 0 and the CARDERR LED
is on). On cold start, the current values are replaced by the most
recent initial values only if a save to memory card function (Backup
Save or %S66 rising edge) was done.
The system resets the bit %S94 to 0 when the replacement has been
made.
Note: this bit must be used with care: do not set this bit permanently
to 1 and use the master task only.
%S95 restore initial values Normally on 0, this bit can be set on 1 by the user to restore the
RESTINITVAL (not for safety PLCs) adjustment values of user function blocks.
%S96 backup program OK TSX Micro:
BACKUPPROGOK (not for safety PLCs)  on 0: application program saves are invalid
 on 1: application program saves are valid
This bit can be read at any time (either by the program or while
adjusting), in particular after a cold start or a warm restart. It is
significant with regard to a PL7-effected backup application within
the internal flash EPROM.
M340:
 Set to 0 by the system when the card is missing or not usable (bad
format, unrecognized type) or card content inconsistent with
internal application RAM.
 Set to 1 when the card is correct and application is consistent with
CPU internal application RAM.
%S97 save %MW OK on 0: %MW saves are invalid
SAVEMWOK (not for safety PLCs) on 1: %MW saves are valid
This bit can be read at any time (either by the program or while
adjusting), in particular after a cold start or a warm restart.

26 EIO0000001714 12/2018
 Differences

NOTE: Quantum Safety PLCs specific system bits usage is described in the Unity_Pro_XLS
Software Operating Modes Specifics guide.

System Words
The following subsets of %SW system word (see EcoStruxure™ Control Expert, System Bits and
Words, Reference Manual) are supported:

Word Function Description

Symbol
%SW0 master task scanning This word is used to modify the period of the master task via the
MASTPERIOD period user program or via the terminal.
The period is expressed in ms (1...255 ms)
%SW0=0 in cyclic operation.
On a cold restart: it takes the value defined by the configuration.
%SW1 fast task scanning period This word is used to modify the period of the fast task via the user
FASTPERIOD (not for safety PLCs) program or via the terminal.
The period is expressed in milliseconds (1...255 ms).
On a cold restart, it takes the value defined by the configuration.
%SW2 auxiliary task scanning This word is used to modify the period of the tasks defined in the
AUX0PERIOD to period configuration, via the user program or via the terminal.
%SW5 (not for safety PLCs) The period is expressed in tens of ms (10ms to 2.55s).
AUX3PERIOD
%SW10 first cycle after cold start If the value of the current task bit is set to 0, this means that the
TSKINIT (not for safety PLCs) task is performing its first cycle after a cold start:
 %SW10.0: assigned to the MAST task
 %SW10.1: assigned to the FAST task
 %SW10.2 to 5: assigned to the AUX 0...3 tasks

%SW11 watchdog duration Reads the duration of the watchdog. The duration is expressed in
WDGVALUE milliseconds (10...1500 ms).
This word cannot be modified.
NOTE: The duration range in Quantum Safety PLCs is: 20...990
ms.
%SW12 mode of application This word indicates the operating mode of the application
APMODE processor processor. Possible values are:
(for safety PLCs only)  16#A501: application processor is in Maintenance Mode
 16#5AFE: application processor is in Safety Mode

Any other value is interpreted as a detected error.

This system word is not available for the standard Quantum CPU.
%SW13 mode of Intel processor This word indicates the operating mode of the Intel Pentium
INTELMODE (for safety PLCs only) processor. Possible values are:
 16#501A: application processor is in Maintenance Mode
 16#5AFE: application processor is in Safety Mode

Any other value is interpreted as a detected error.

This system word is not available for the standard Quantum CPU.

EIO0000001714 12/2018 27
Differences

Word Function Description

Symbol
%SW15 PLC processor patch This word contains the commercial version of the PLC processor
OSCOMMPATCH version patch.
It is coded onto the least significant byte of the word.
coding: 0 = no patch, 1 = A, 2 = B...
Example: 16#0003 corresponds to patch C.
%SW17 error status on floating When an error in a floating arithmetic operation is detected, bit
FLOATSTAT operation %S18 is set to 1 and %SW17 error status is updated according to the
(%SW17 System word is following coding:
also managed by  %SW17.0 = Invalid operation / result is not a number
Quantum Safety PLCs)  %SW17.1 =Denormalized operand / result is acceptable (flag
not managed by Modicon M340 or Quantum Safety PLCs)
 %SW17.2 = Division by 0 / result is infinity
 %SW17.3 = Overflow / result is infinity
 %SW17.4 = Underflow / result is 0
 %SW17.5 to 15 = not used

This word is reset to 0 by the system on cold start, and also by the
program for re-usage purposes.
%SW18 absolute time counter %SW18 is the low and %SW19 the high word for calculating
%SW19 durations. Both are incremented every 1/10th of a second by the
100MSCOUNTER system (even when the PLC is in STOP, they are no longer
incremented if it is powered down). They can be read and written
by the user program or by the terminal.
%SW20 absolute time counter The low word %SW20 and the high word %SW21 are incremented
%SW21 every 1/1000th of a second by the system (even when the PLC is
MSCOUNTER in STOP, they are no longer incremented if it is powered down).
They can be read by the user program or by the terminal. %SW20
and %SW21 are reset on a cold start, but not on a warm start.
%SW26 number of requests This system word allows to verify on server side the number of
processed requests processed by PLC per second.
NOTE: This system word is available only for Modicon M340
CPU.
%SW30 master task execution This word indicates the execution time of the last master task cycle
MASTCURRTIME time (in ms).
Note: In general %SW30 works, but keep in mind that a PC is much
faster as a PLC. For a short application a scan time less than 1ms
is possible, in such a case %SW30 remains at 0. %SW30 will not be
updated when an exception (division by 0, overflow, etc.) occurs
during execution of the user logic or after any user debug activity.
If an application throws an exception in each cycle, %SW30 will
remain at 0 and %SW31, %SW32 will remain at 32768 and 32767
from the beginning.

28 EIO0000001714 12/2018
 Differences

Word Function Description

Symbol
%SW31 maximum master task This word indicates the longest master task execution time since
MASTMAXTIME execution time the last cold start (in ms).
%SW32 minimum master task This word indicates the shortest master task execution time since
MASTMINTIME execution time the last cold start (in ms).
%SW33 fast task execution time This word indicates the execution time of the last fast task cycle (in
FASTCURRTIME (not for safety PLCs) ms).
%SW34 maximum fast task This word indicates the longest fast task execution time since the
FASTMAXTIME execution time last cold start (in ms).
(not for safety PLCs)
%SW35 minimum fast task This word indicates the shortest fast task execution time since the
FASTMINTIME execution time last cold start (in ms).
(not for safety PLCs)
%SW36 auxiliary task execution Those words indicate the execution time of the last cycle of the
AUX0CURRTIME time AUX 0...3 tasks (in ms).
%SW39 (different function in
NOTE: %SW36 and %SW39 words have a different function in
AUX1CURRTIME Safety PLCs)
Quantum Safety PLCs and the other words are not available on
%SW42
AUX2CURRTIME Quantum safety PLCs.
%SW45
AUX3CURRTIME
%SW37 maximum auxiliary task Those words indicate the longest task execution time of AUX 0...3
AUX0MAXTIME execution time tasks since the last cold start (in ms).
%SW40 (different function in
NOTE: %SW37 word has a different function in Quantum Safety
AUX1MAXTIME Safety PLCs)
PLCs and the other words are not available on Quantum safety
%SW43
AUX2MAXTIME PLCs.
%SW46
AUX3MAXTIME
%SW38 minimum auxiliary task Those words indicate the shortest task execution time of AUX 0...3
AUX0MINTIME execution time tasks since the last cold start (in ms).
%SW41 (different function in
NOTE: %SW38 word has a different function in Quantum Safety
AUX1MINTIME Safety PLCs)
PLCs and the other words are not available on Quantum safety
%SW44
AUX2MINTIME PLCs.
%SW47
AUX3MINTIME
%SW48 number of events This word indicates the number of IO events and telegram
IOEVTNB (not for safety PLCs) processed since the last cold start. This word can be written by the
program or the terminal
NOTE: TELEGRAM is available only for PREMIUM (not on
Quantum neither M340).

EIO0000001714 12/2018 29
Differences

Word Function Description

Symbol
%SW49 real-time clock function System words containing date and current time (in BCD):
DAYOFWEEK  %SW49:
%SW50 Day of the week:
SEC  1 = Monday,
%SW51  2 = Tuesday,
HOURMIN  3 = Wednesday,
%SW52  4 = Thursday,
MONTHDAY
 5 = Friday,
%SW53
 6 = Saturday,
YEAR
 7 = Sunday,

 %SW50: Seconds (16#SS00),

 %SW51: Hours and Minutes (16#HHMM),
 %SW52: Month and Day (16#MMDD),
 %SW53: Year (16#YYYY).

These words are managed by the system when the bit %S50 is set
to 0.
These words can be written by the user program or by the terminal
when the bit %S50 is set to 1.
For M580:
 The current time is in UTC (Coordinated Universal Time). If a
local time is needed, use the RRTC_DT function.
%SW54 real-time clock function System words containing date and time of the last power failure or
STOPSEC on last stop PLC stop (in Binary Coded Decimal):
%SW55  %SW54: Seconds (00SS),
STOPHM  %SW55: Hours and Minutes (HHMM),
%SW56  %SW56: Month and Day (MMDD),
STOPMD
 %SW57: Year (YYYY),
%SW57
 %SW58:
STOPYEAR
The most significant byte contains the day of the week (1 for
%SW58
STOPDAY Monday through to 7 for Sunday), and the least significant byte
contains the code for the last stop:
 1 = change from RUN to STOP by the terminal or the
dedicated input,
 2 = stop by watchdog (PLC task or SFC overrun),
 4 = power outage or memory card lock operation,
 5 = stop on hardware fault,
 6 = stop on software fault. Details on the type of software
fault are stored in %SW125.
%SW70 real-time clock function System word containing the number of the week in the year: 1 to
WEEKOFYEAR 52.

30 EIO0000001714 12/2018
 Differences

Word Function Description

Symbol
%SW71 position of the switches This word provides the image of the positions of the switches on
KEY_SWITCH on the Quantum front the front panel of the Quantum processor. This word is updated
panel automatically by the system:
 %SW71.0 = 1 switch in the "Memory protected" position,
 %SW71.1 = 1 switch in the "STOP" position,
 %SW71.2 = 1 switch in the "START" position,
 %SW71.8 = 1 switch in the "MEM" position,
 %SW71.9 = 1 switch in the "ASCII" position,
 %SW71.10 = 1 switch in the "RTU" position,
 %SW71.3 to 7 and 11 to 15 are not used.

%SW75 Timer-type event counter This word contains the number of timer-type events in the queue.
TIMEREVTNB (1): Not available on the following processors:
TSX 57 1•/2•/3•/4•/5•.
This word is not available on Quantum Safety PLCs.
%SW75 timer-type event counter This word contains the number of timer-type events in the queue.
TIMEREVTNB (not for safety PLCs)
%SW76 diagnostics function: Result of the last registration:
DLASTREG recording  = 0 if the recording was successful,
 = 1 if the diagnostics buffer has not been configured,
 = 2 if the diagnostics buffer is full.

%SW77 diagnostics function: Result of the last deregistration:

DLASTDEREG non-recording  = 0 if the non-recording was successful,
 = 1 if the diagnostics buffer has not been configured,
 = 21 if the error identifier is invalid,
 = 22 if the error has not been recorded.

%SW78 diagnostics function: Number of errors currently in the diagnostics buffer.

DNBERRBUF number of errors
%SW87 communication flow Number of requests processed by synchronous server per master
MSTSERVCNT management (MAST) task cycle.
The requests processed may come from communication ports
(having access to the server Modbus/UNI-TE, each of them having
its own limitation). This means also that requests from other
clients, then communication EFs like IO Scanner, connected HMI
and so on should be counted.
%SW90 maximum number of This word is used to set a maximum number of requests which can
MAXREQNB requests processed per be processed by the PLC per master task cycle.
master task cycle When the CPU is the server: This number of requests must be
between 2 (minimum) and N+4 (maximum).
N: number differs depending on the model.
When the CPU is the client:
N: number differs depending on the model.
The value 0 will not work. If a value that is outside of the range is
entered, it is the value N that is taken into account.

EIO0000001714 12/2018 31
Differences

Word Function Description

Symbol
%SW93 memory card file system Can be read and written by the user program or the terminal. This
erasing command and word is used by the customer to erase the memory card. Erasing
status is possible only in Stop mode:
 %SW93.0 = 1 a rising edge starts the erasing operation.

%SW93.1 gives the file system status after an erasing request:

 %SW93.1 = 0 invalid files system (bad format, erasing in
progress),
 %SW93.1 = 1 valid files system.

%SW96 command and diagnostic This word is used to copy or delete the current value of %MW to or
CMDDIAGSAVEREST of save and restore from internal flash memory and to give the action’s status. It can be
read by the user program or by the terminal:
 %SW96.0: Request to copy current value of %MW to internal
Flash memory. Set to 1 by the user to request a save, and set
to 0 by the system when a save is in progress.
NOTE: You must stop the processor before copying via
%SW96.0.
 %SW96.1 is set to 1 by the system when a save is finished, and
set to 0 by the system when a save is in progress.
 %SW96.2 = 1 indicates an error on a save or restore operation
(see %SW96.8 to 15 for error code definitions).
 %SW96.3 = 1 indicates that a restore operation is in progress.
 %SW96.4 may be set to 1 by the user to delete %MW area in
internal Flash memory.
 %SW96.7 = 1 indicates that internal memory has valid %MW
backup.
 %SW96.8 to 15 are error codes:
When %SW96.2 is set to 1:
 %SW96.9 = 1 indicates that the saved %MW number is less
than the configured number,
 %SW96.8 = 1 and %SW96.9 = 1 mean that the saved
%MW number is greater than the configured number,
 %SW96.8 = 1, %SW96.9 = 1 and %SW96.10 = 1
indicate a write error in internal flash memory.

32 EIO0000001714 12/2018
 Differences

Word Function Description

Symbol
%SW97 card status Can be read by the user program or by the terminal. Indicates the
CARDSTS status of the card.
%SW97:
0000 = no error.
0001 = application backup or file write sent to a write-protected
card.
0002 = card not recognized, or application backup damaged.
0003 = backup of the application requested, but no card available.
0004 = card access error, for example after a card has been
removed improperly.
0005 = no file system present in the card, or file system not
compatible. Use %SW93.0 to format the card.
%SW108 number of forced I/O This system word counts the number of forced I/O module bits.
FORCEDIOIM module bits This word is incremented for every forcing, and decremented for
every unforcing.
%SW109 number of forced analog This system word counts the number of forced analog channels.
FORCEDANA channels This word is incremented for every forcing, and decremented for
every unforcing.
%SW124 type of processor or This system word is updated when the PLC is put in the error state.
CPUERR system error The possible values are:
 0x0065: execution of HALT impossible,
 0x0080: system watchdog.

When the PLC is put in safety error state the content of %SW125 is
updated and can be read after the next restart of the PLC (see
below).

EIO0000001714 12/2018 33
Differences

Word Function Description

Symbol
%SW125 last fault detected The code of the last fault detected is given in this word: The
BLKERRTYPE following error codes cause the PLC to stop if %S78 is set to 1.
%S15, %S18 and %S20 are always activated independently of
%S78:
 16#0002: verification of PCMCIA signature fails,
 16#2258: execution of HALT instruction,
 16#2302: call to non supported system function in a user
function block,
 16#9690: error of application CRC detected in background,
 16#DE87: calculation error on floating-point numbers (%S18,
these errors are listed in the word %SW17),
 16#DEB0: Watchdog overflow (%S11),
 16#DEF0: division by 0 (%S18)
 16#DEF1: character string transfer error (%S15),
 16#DEF2: arithmetic error (%S18),
 16#DEF3: index overflow (%S20).

Note: The codes 16#8xxx and 16#7xxx do not stop the application
and indicate an error on function blocks.
In case of a safety error, the PLC will stop. After power off and
restart of the PLC, %SW125 will contain the code of the cause of the
error:
 0x5AF1: Sequence check error (unpredictable execution in
CPU)
 0x5AF2: Error in memory (address fault)
 0x5AF3: Comparison error (execution results of Intel and
application processor differ)
 0x5AF4: Real-time clock failure
 0x5AF5: Error initializing double code execution
 0x5AF6: Watchdog activation error
 0x5AF7: Error during memory check (takes more than 8 hours)
 0x5AF8: Error in memory check (RAM failure)

Note: %SW125 is only reset after init or complete download or

restart (it always contains the last fault detected).

34 EIO0000001714 12/2018
 Differences

Word Function Description

Symbol
%SW126 blocking error instruction Address of the instruction that generated the application blocking
ERRADDR0 address error.
%SW127 For 16 bit processors:
ERRADDR1  %SW126 contains the offset for this address,
 %SW127 contains the segment number for this address.

For 32 bit processors:

 %SW126 contains the least significant word for this address,
 %SW127 contains the most significant word for this address.

In case of a safety error, the content of %SW126 and %SW127 is

for Schneider Electric use only.

NOTE: Quantum Safety PLCs specific system words usage is described in the Unity_Pro_XLS
Software Operating Modes Specifics guide.

EIO0000001714 12/2018 35
Differences

36 EIO0000001714 12/2018
 EcoStruxure™ Control Expert
Menu Commands
EIO0000001714 12/2018

Chapter 3
Menu Commands and Dialog Boxes in the PLC Simulator

Menu Commands and Dialog Boxes in the PLC Simulator

Overview
This chapter describes the menu commands and dialog boxes in the PLC simulator.

What Is in This Chapter?

This chapter contains the following topics:
Topic Page
Simulator Control 38
Simulator Control for Unknown CPU 39
Simulator Control for Modicon M580 CPU 42
Simulator Control for Modicon M580 Safety CPU 44
Memory Card for Modicon M580 CPU 47
Simulator Control for Modicon Quantum CPU 51
Simulator Control for Modicon Quantum Safety CPU 54
Simulator Control for Modicon Premium CPU 57
Simulator Control for Modicon M340 CPU 59
Memory Card for Modicon M340 CPU 62
Simulator Control for Modicon Momentum CPU 66
Event Dialog 68
Clear 69
Reset 70
Power Cycle 71
Options 72
Timing (simulator) 73
Processor Load 74
Priority of the Simulator 76
Data in the User Task 77
Minimal Sample Time 78
Info 79
Help 80
Ending the Simulation 81

EIO0000001714 12/2018 37
Menu Commands

Simulator Control

Description
You can open and close the simulator dialog using:
 The menu command Simulator Control in the context menu of the simulator symbol in the task
bar or the simulator symbol.
 A double-click with the left mouse button on the simulator symbol in the task bar.

One of the following dialog boxes is opened or closed depending on the project loaded:
 Unknown CPU (see page 39)
 Modicon M580 CPU (see page 42)
 Modicon Quantum CPU (see page 51)
 Modicon Quantum Safety CPU (see page 54)
 Modicon Premium CPU (see page 57)
 Modicon M340 CPU (see page 59)
 Modicon Momentum CPU (see page 66)

38 EIO0000001714 12/2018
 Menu Commands

Simulator Control for Unknown CPU

Introduction
This dialog box is shown if the simulator does not know which CPU type should be simulated.
This is the case for example in the following situations:
 Directly after the simulator is started and before a project is loaded.
 If the simulated CPU is in NOCONF state (in other words a valid project is not loaded in the
simulator).
Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU and the project in a two line display.
The first line shows the current state of the CPU and can contain the following texts:

Text in the first The simulated Meaning

line CPU is in state...
NOCONF NOCONF (no No user project loaded or the loaded project is
configuration) invalid.
IDLE IDLE The project loaded on the CPU has not been started
or reset with the Reset button.
STOP STOPPED No project is running. However, the loaded project
was in RUN state at least once.
RUN RUN A project with at least one task is running.

EIO0000001714 12/2018 39
Menu Commands

Text in the first The simulated Meaning

line CPU is in state...
HALT HALT An error has occurred in the project. The simulated
CPU must be reinitialized or reset using the Reset
button.
ERROR ERROR An unrecoverable detected error has occurred in the
project. This means communication is no longer
possible. The simulated CPU must be reset using
the Reset button.

The second line shows the current state of the project and can contain the following texts:

Text in the Meaning

Second Line
INVALID No user project loaded or the loaded project is invalid.
CHECKED The project was checked formally and found to be valid. However, the
CPU has not been configured using this project.
CONF The project was checked formally and found to be valid. The CPU has
been configured using this project.

Events
With this button, you can open and close the event dialog box (see page 68).
The button is shown if I/O events are defined in the project currently loaded (if the project uses
event tasks).

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the CPU (the
connection between Control Expert and the simulator is broken, project variables are reset).
This button corresponds to the reset button on a real CPU.

Power Cycle
With this button, you simulate a warm start of the CPU. It means that the connection between
Control Expert and the simulator is broken, the current project variables remain and the simulator
goes into the state RUN (autostart active) or STOP (autostart deactivated).
A power cycle corresponds to a power off and power on of a real power supply.

40 EIO0000001714 12/2018
 Menu Commands

Simulation
Dialog box fields:
Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.
Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.
Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP with
the host PC of the simulator (see page 15)). The DNS name and TCP/IP address are shown for
each client.

EIO0000001714 12/2018 41
Menu Commands

Simulator Control for Modicon M580 CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon M580 family.
Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU in a multi-line display using
combinations of the RUN and ERR LEDs:

RUN LED ERR LED The simulated Meaning

CPU is in state...
– – NOCONF The LED display is replaced with NOCONF - INVALID display.
No user project loaded or the loaded project is invalid.
flashing off STOP The project loaded on the PLC has not been started or has been
reset with the Reset button.
on off RUN A project with at least one task is running.
flashing flashing HALT A detected error has occurred in the project. The simulated CPU
must be reinitialized or reset using the Reset button.
off on – An unrecoverable detected error has occurred in the project.
This means communication is no longer possible. The
simulated CPU must be reset using the Reset button.

42 EIO0000001714 12/2018
 Menu Commands

The BACKUP LED is on if a problem occurs during simulated card access or if the simulated
memory card is removed.
The I/O, DL, ETH MS, ETH NS, and FORCED I/O LEDs are not supported by the simulator.

Card Acc
The Card Acc LED is on when the card is accessible.

Memory Card
Simulated features of a memory card for the Modicon M580 CPU (see page 47):
 Files on the memory card generated by the data storage function blocks.
 Remove/insert memory card.
 Memory card full.
 Write protection.

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the CPU
where the connection between Control Expert and the simulator is broken, project variables are
reset and the simulator goes in RUN (if auto start is activated) or in STOP (if auto start is
deactivated)).

Power Cycle
With this button, you execute a power cycle (power off/ power on) for the simulated CPU. This
corresponds to a warm start of the CPU (the connection between Control Expert and the simulator
is broken and the current project variables remain).
A power cycle corresponds to a power off and power on of a real power supply.

Simulation
Dialog box fields:
Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.
Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.
Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP with
the host PC of the simulator (see page 15)). The DNS name and TCP/IP address are shown for
each client.

EIO0000001714 12/2018 43
Menu Commands

Simulator Control for Modicon M580 Safety CPU

Introduction
The dialog box is shown if the simulator is simulating a Modicon M580 Safety CPU.
Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU in a multi-line display using
combinations of the RUN and ERR LEDs:

LEDs The simulated Meaning

RUN ERR SRUN S M CPU is in state...

– – – – – NOCONF The LED display is

replaced with
NOCONF - INVALID
display.
No user project
loaded or the loaded
project is invalid.
flashing off on: SAFE on: Safety off STOP The project loaded
task running mode on the PLC has not
off: SAFE been started or has
off flashing:
task stopped. been reset with the
Maintenance
mode Reset button.

44 EIO0000001714 12/2018
 Menu Commands

LEDs The simulated Meaning

RUN ERR SRUN S M CPU is in state...

on off on: SAFE on: Safety off RUN A project with at least
task running mode one task is running.
off: SAFE
off flashing:
task stopped. Maintenance
mode
flashing flashing on: SAFE on: Safety off HALT A detected error has
task running mode occurred in the
off: SAFE project. The
off flashing:
task stopped. simulated CPU must
Maintenance
mode be reinitialized or
reset using the Reset
button.
off on off off off SAFE An unrecoverable
detected error has
occurred in the
project. This means
communication is no
longer possible. The
simulated CPU must
be reset using the
Reset button.

The BACKUP LED is on if a problem occurs during simulated card access or if the simulated
memory card is removed.
The I/O, DL, ETH MS, ETH NS, and FORCED I/O LEDs are not supported by the simulator.

Card Acc
The Card Acc LED is on when the card is accessible.

Memory Card
Simulated features of a memory card for the Modicon M580 CPU (see page 47):
 Files on the memory card generated by the data storage function blocks.
 Remove/insert memory card.
 Memory card full.
 Write protection.

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the CPU
where the connection between Control Expert and the simulator is broken, project variables are
reset and the simulator goes in RUN (if auto start is activated) or in STOP (if auto start is
deactivated)).

EIO0000001714 12/2018 45
Menu Commands

Power Cycle
With this button, you execute a power cycle (power off/ power on) for the simulated CPU. This
corresponds to a warm start of the CPU (the connection between Control Expert and the simulator
is broken and the current project variables remain).
A power cycle corresponds to a power off and power on of a real power supply.

Simulation
Dialog box fields:
Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.
Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.
Project name: Name of the project loaded in the simulator.

Connected Clients
The list shows current clients connected with the PC (PCs which are connected via TCP/IP with
the host PC of the simulator (see page 15)). The DNS name and TCP/IP address are shown for
each client.

46 EIO0000001714 12/2018
 Menu Commands

Memory Card for Modicon M580 CPU

Overview
The Modicon M580 PLC simulator panel displays a memory card in the bottom left corner of the
virtual front plate, for both M580 PLCs and M580 Safety PLCs. See, for example, Simulator control
for Modicon M580 CPU (see page 42).
The memory card is inserted by default after the startup of the PLC Simulator.

No Backup/Restore
On a real Modicon M580 CPU, the memory card is separated in 2 parts:
 A part for the OS, where the application is stored persistent (backup/restore mechanism).
 A part for the application, where the application can store data by using data storage function
blocks.
NOTE: The simulator does not simulate the backup/restore part of the memory card.

Not Simulated Features of a Memory Card

The following features of a real memory card are not supported:
 Backup/restore to/from memory card.
 Operating modes for memory cards.
 %S66 (APPLIBCK).

Simulated Features of a Memory Card

The following features of a memory card can be simulated for the Modicon M580 CPU:
 Files on the memory card generated by the data storage function blocks.
 Remove/insert memory card.
 Memory card full.
 Write protection.

File Management Function Blocks

The simulator supports the file management function blocks and simulates the generation of the
files on the PC.
A directory on the PC simulates the file management part of the memory card. In this directory, the
files created by the user application are stored.
The directory used for memory card simulation is either the default one (C:\Documents and
Settings\USERNAME\Local Settings\Temp\DataStorage) or the directory used during the last
simulation. The last used directory is stored persistent in the registry.
The files written by the application can be accessed by normal tools like an editor or Office tools.

EIO0000001714 12/2018 47
Menu Commands

The simulator never deletes the application written files. If an application needs to have a blank
empty memory card, the system word %SW93 (Memory Card File System Format) has to be used
in STOP state of the CPU.
NOTE: There is no tracking of the size and number of files written into the memory card.

Limitations for File Management Function Blocks

 Error codes generated by these functions/function blocks may be different between
PLC simulator and a real CPU.
 With the PLC simulator, it is not possible to delete a file that is opened (neither with the
DELETE_FILE function, nor by FTP command).
It is mandatory to close the file before deleting it, in order to delete the file descriptor.
Trying to delete a file that is opened generates a general error code (-1).
 The SET_FILE_ATTRIBUTES function is not supported by the PLC simulator.
Trying to call this function generates a general error (-1).
For detailed information about the file management functions/function blocks please refer to the
System Block Library documentation.

Remove Memory Card

By default the memory card is inserted at simulator start.
The procedure for removing the memory card is as follows:

Step Action
1 Set the system bit %S65 (CARDIS).
Result: After a potential card access has finished the Card Acc LED goes out.
2 Open the context menu by clicking the memory card with the right mouse button.
3 Select Remove Memory Card....
Result: The virtual front plate shows an empty memory card slot and the
CARDERR LED is on.

NOTE: Removing the memory card has no influence on the used directory and the files, but the
access to the files is disabled inside the simulator.

48 EIO0000001714 12/2018
 Menu Commands

Insert Memory Card

The procedure for inserting the memory card is as follows:

Step Action
1 Open the context menu by clicking the memory card with the right mouse button.
2 Select Insert Memory Card....
Result: A Windows standard file selection dialog opens. The selection is pre-
initialized with the last used memory card directory.
Note: The file selection box also has a Write protected check box to insert a write
protected virtual memory card.
3 Proceed with one of the 2 following possibilities:
 Use the preinitialized directory.
Result: The last removed memory card is inserted.
 Select another directory.
Result: Another memory card (for example different in content or empty) is
inserted.
Result: The CARDERR LED turns off.
4 Reset the system bit %S65 (CARDIS).
Result: The virtual front plate shows a memory card and the Card Acc LED goes
on.

Since a directory and its content represent the memory card, exchanging the content of the
directory can simulate the exchange of a memory card. This can be done by normal Windows
means (cut/copy/paste of files or renaming/moving folders).

Memory Card Full

By default the memory card is not full at simulator start.
Since there is no size tracking, at any time it is possible to simulate that the memory card is full.
This is done by opening the context menu (right-click the memory card) and selecting the menu
command Memory Card Full.
After this menu command is selected:
 New data writing is not possible.
 Read accesses are possible.
 Overwrite actions are possible.

This state is indicated by the check mark in the context menu command.

EIO0000001714 12/2018 49
Menu Commands

Write Protection
By default the memory card is not write protected at simulator start.
At any time, it is possible to simulate that the memory card is write protected.
This is done by opening the context menu (right-click the memory card) and selecting the menu
command Write Protection.
After this menu command is selected:
 Data writing is not possible.
 Read accesses are possible.

This state is indicated by the check mark in the context menu command.
Control Expert adds some restrictions linked with the memory card (for example program
modification is forbidden if the card is write protected). The simulator supports these restrictions
too.
To simulate the write protection feature the following system bits and words are supported by the
simulator:
 %S65 (CARDIS)
 %S96 (BACKUPPROGOK)
 %SW97 (CARDSTS)

NOTE: It is not possible to access the files via an FTP client through the simulator since the files
are directly accessible by Windows features.

50 EIO0000001714 12/2018
 Menu Commands

Simulator Control for Modicon Quantum CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon Quantum family.
Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU in a one line display:

Text in the display The simulated Meaning

CPU is in state...
Init INIT (Initialization) This display is shown for a very short time while the
simulator is starting. It is quickly replaced by one of
the following displays.
UnCfg NOCONF (no No user project loaded or the loaded project is
configuration) invalid.
Idle IDLE The project loaded on the CPU has not been started
or reset with the Reset button.
Stop STOPPED No project is running. However, the loaded project
was in RUN state at least once.
Run RUN A project with at least one task is running.

EIO0000001714 12/2018 51
Menu Commands

Text in the display The simulated Meaning

CPU is in state...
Halt HALT An error has occurred in the project. The simulated
CPU must be reinitialized or reset using the Reset
button.
Err ERROR An unrecoverable detected error has occurred in the
project. This means communication is no longer
possible. The simulated CPU must be reset using
the Reset button.

Key Switch
By clicking the switch symbol, various switch positions can be simulated:

Switch position Switch position Meaning

on real CPU
Start CPU unlocked:
 Project can be loaded.
 CPU can be started or stopped.

Mem Prt CPU locked:

 Project cannot be loaded.
 As opposed to the key switch on a real CPU, the
CPU can be started or stopped in this position.
- Stop This switch position of a real CPU is not supported by
the simulator.

Events
With this button, you can open and close the event dialog box (see page 68).
The button is shown if I/O events are defined in the project currently loaded (if the project uses
event tasks).

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the CPU (the
connection between Control Expert and the simulator is broken, project variables are reset and the
simulator goes in RUN (if auto start is activated) or in STOP (if auto start is deactivated)).
Reset corresponds to the reset button on a real CPU.

52 EIO0000001714 12/2018
 Menu Commands

Power Cycle
With this button, you execute a power cycle (power off / power on) for the simulated CPU. This
corresponds to a warm start of the CPU (the connection between Control Expert and the simulator
is broken and the current project variables remain).
A power cycle corresponds to a power off and power on of a real power supply.

Simulation
Dialog box fields:
Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.
Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.
Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP with
the host PC of the simulator (see page 15)). The DNS name and TCP/IP address are shown for
each client.

EIO0000001714 12/2018 53
Menu Commands

Simulator Control for Modicon Quantum Safety CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon Quantum safety
family.
Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the safety CPU in a display:

Text in the display The simulated Meaning

CPU is in state...
Init INIT (Initialization) This display is shown for a very short time while the simulator is
starting. It is quickly replaced by one of the following displays.
UnCfg NOCONF (no No user project loaded or the loaded project is invalid.
configuration)
Idle IDLE The project loaded on the CPU has not been started or reset with the
Reset command button.
Stop STOPPED No project is running. However, the loaded project was in RUN state
at least once.
Run RUN A project with at least one task is running.
Halt HALT An error has occurred in the project. The simulated CPU must be
reinitialized or reset using the Reset command button.

54 EIO0000001714 12/2018
 Menu Commands

Text in the display The simulated Meaning

CPU is in state...
Err ERROR An unrecoverable detected error has occurred in the project. This
means communication is no longer possible. The simulated CPU
must be reset using the Reset command button.
S Safety Mode The project is running in safety mode.
For further information on the different modes please refer to the
Unity Pro XLS Software Specifics manual.
M Maintenance The project is running in maintenance mode.
Mode For further information on the different modes please refer to the
Unity Pro XLS Software Specifics manual.

Safety/Maintenance Mode (Safety Projects)

For switching between safety and maintenance mode please pay attention to the following special
features:
 Switching from safety to maintenance mode in Control Expert XLS Software is only possible, if
the simulator key switch is unlocked (see table below).
 Switching from maintenance to safety mode can be done by setting the key switch position of
the simulator to locked.
 If the simulator is in maintenance mode and Control Expert XLS Software is disconnected from
the simulator, it is automatically set to safety mode.
NOTE: The CPU simulator has no double code execution of the logic and comparison of the
results. Therefore the execution behaves the same in safety and maintenance mode.
For further information on the different modes please refer to the Unity Pro XLS Software Specifics
manual.

Key Switch
By clicking the switch symbol, various switch positions can be simulated:

Switch position Switch position Meaning

on real CPU
Start CPU unlocked:
 Project can be loaded.
 CPU can be started or stopped.

Mem Prt CPU locked:

 Project can not be loaded.
 As opposed to the key switch on a real CPU, the CPU can be started
or stopped in this position.
- Stop This switch position of a real CPU is not supported by the simulator.

EIO0000001714 12/2018 55
Menu Commands

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the CPU (the
connection between the Control Expert and the simulator is broken, project variables are reset).
This command button corresponds to the reset button on a real CPU.

Power Cycle
With this button, you simulate a cold start of the CPU as a safety CPU does not support warm start.
The connection between Control Expert and the simulator is broken, the simulator goes into the
state RUN (autostart active) or STOP (autostart deactivated).
This command button corresponds to the power off and power on of a real power supply.

Simulation
Dialog box fields:
Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.
Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.
Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP with
the host PC of the simulator (see page 15)). The DNS name and TCP/IP address are shown for
each client.

56 EIO0000001714 12/2018
 Menu Commands

Simulator Control for Modicon Premium CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon Premium family.
Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU in a multi-line display using
combinations of the RUN and ERR LEDs:

RUN LED ERR LED The simulated CPU Meaning

is in state...
off flashing NOCONF (no No user project loaded or the loaded project is invalid.
configuration)
flashing off IDLE The project loaded on the CPU has not been started or reset
with the Reset button.
flashing off STOPPED No project is running. However, the loaded project was in
RUN state at least once.
on off RUN A project with at least one task is running.
off flashing HALT An error has occurred in the project. The simulated CPU must
be reinitialized or reset using the Reset button.
off on ERROR An unrecoverable detected error has occurred in the project.
This means communication is no longer possible. The
simulated CPU must be reset using the Reset button.

EIO0000001714 12/2018 57
Menu Commands

When data is being exchanged between Control Expert and the simulator, the TER LED is
flashing.
The CH0, CH1, CH2, CH3, I/O, and FIP LEDs are no supported by the simulator.

Events
With this button, you can open and close the event dialog box (see page 68).
The button is shown if I/O events are defined in the project currently loaded (if the project uses
event tasks).

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the CPU
where the connection between Control Expert and the simulator is broken, project variables are
reset and the simulator goes in RUN (if auto start is activated) or in STOP (if auto start is
deactivated)).
Reset corresponds to the reset button on a real CPU.

Power Cycle
With this button, you execute a power cycle (power off/ power on) for the simulated CPU. This
corresponds to a warm start of the CPU (the connection between Control Expert and the simulator
is broken and the current project variables remain).
A power cycle corresponds to a power off and power on (or pressing the reset button) of a real
power supply.

Simulation
Dialog box fields:
Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.
Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.
Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP with
the host PC of the simulator (see page 15)). The DNS name and TCP/IP address are shown for
each client.

58 EIO0000001714 12/2018
 Menu Commands

Simulator Control for Modicon M340 CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon M340 family.
Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU in a multi-line display using
combinations of the RUN and ERR LEDs:

RUN ERR LED The simulated Meaning

LED CPU is in state...
off flashing NOCONF (no No user project loaded or the loaded project is invalid.
configuration)
flashing off IDLE The project loaded on the CPU has not been started or reset with
the Reset button.
flashing off STOPPED No project is running. However, the loaded project was in RUN
state at least once.
on off RUN A project with at least one task is running.

EIO0000001714 12/2018 59
Menu Commands

RUN ERR LED The simulated Meaning

LED CPU is in state...
off flashing HALT An error has occurred in the project. The simulated CPU must be
reinitialized or reset using the Reset button.
off on ERROR An unrecoverable detected error has occurred in the project. This
means communication is no longer possible. The simulated CPU
must be reset using the Reset button.

When data is being exchanged between Control Expert (or other clients) and the simulator, the
SER COM LED is flashing.
The CARDERR LED is ON if a problem occurs during card access or if the memory card is
removed.
The I/O, CAN RUN, CAN ERR, ETH ACT, ETH STS, and 10/100 LEDs are not supported by the
simulator.

Card Acc
The Card Acc LED is on when the card is accessible.

Memory Card
The following features of a memory card can be simulated for the Modicon M340 CPU
(see page 62):
 Files on the memory card generated by the data storage function blocks.
 Remove/insert memory card.
 Memory card full.
 Write protection.

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the CPU
where the connection between Control Expert and the simulator is broken, project variables are
reset and the simulator goes in RUN (if auto start is activated) or in STOP (if auto start is
deactivated)).

Power Cycle
With this button, you execute a power cycle (power off/ power on) for the simulated CPU. This
corresponds to a warm start of the CPU (the connection between Control Expert and the simulator
is broken and the current project variables remain).
A power cycle corresponds to a power off and power on of a real power supply.

60 EIO0000001714 12/2018
 Menu Commands

Simulation
Dialog box fields:
Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.
Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.
Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP with
the host PC of the simulator (see page 15)). The DNS name and TCP/IP address are shown for
each client.

EIO0000001714 12/2018 61
Menu Commands

Memory Card for Modicon M340 CPU

Overview
The Modicon M340 PLC simulator panel displays a memory card in the bottom left corner of the
virtual front plate. See Simulator Control for Modicon M340 CPU, page 59.
The memory card is inserted by default after the startup of the PLC Simulator.

No Backup/Restore
On a real Modicon M340 CPU, the memory card is separated in 2 parts:
 A part for the OS, where the application is stored persistent (backup/restore mechanism).
 A part for the application, where the application can store data by using data storage function
blocks.
NOTE: The simulator does not simulate the backup/restore part of the memory card.

Not Simulated Features of a Memory Card

The following features of a real memory card are not supported:
 Backup/restore to/from memory card.
 Operating modes for memory cards.
 %S66 (APPLIBCK).

Simulated Features of a Memory Card

The following features of a memory card can be simulated for the Modicon M340 CPU:
 Files on the memory card generated by the data storage function blocks.
 Remove/insert memory card.
 Memory card full.
 Write protection.

File Management Function Blocks

The simulator supports the file management function blocks and simulates the generation of the
files on the PC.
A directory on the PC simulates the file management part of the memory card. In this directory, the
files created by the user application are stored.
The directory used for memory card simulation is either the default one (C:\Documents and
Settings\USERNAME\Local Settings\Temp\DataStorage) or the directory used during the last
simulation. The last used directory is stored persistent in the registry.
The files written by the application can be accessed by normal tools like an editor or Office tools.

62 EIO0000001714 12/2018
 Menu Commands

The simulator never deletes the application written files. If an application needs to have a blank
empty memory card, the system word %SW93 (Memory Card File System Erasing) has to be used
in STOP state of the CPU.
NOTE: There is no tracking of the size and number of files written into the memory card.

Limitations for File Management Function Blocks

 Error codes generated by these functions/function blocks may be different between
PLC simulator and a real CPU.
 With the PLC simulator, it is not possible to delete a file that is opened (neither with the
DELETE_FILE function, nor by FTP command).
It is mandatory to close the file before deleting it, in order to delete the file descriptor.
Trying to delete a file that is opened generates a general error code (-1).
 The SET_FILE_ATTRIBUTES function is not supported by the PLC simulator.
Trying to call this function generates a general error (-1).
For detailed information about the file management functions/function blocks please refer to the
System Block Library documentation.

Remove Memory Card

By default the memory card is inserted at simulator start.
The procedure for removing the memory card is as follows:

Step Action
1 Set the system bit %S65 (CARDIS).
Result: After a potential card access has finished the Card Acc LED goes out.
2 Open the context menu by clicking the memory card with the right mouse button.
3 Select Remove Memory Card....
Result: The virtual front plate shows an empty memory card slot and the CARDERR LED is on.

NOTE: Removing the memory card has no influence on the used directory and the files, but the
access to the files is disabled inside the simulator.

Insert Memory Card

The procedure for inserting the memory card is as follows:

Step Action
1 Open the context menu by clicking the memory card with the right mouse button.
2 Select Insert Memory Card....
Result: A Windows standard file selection dialog opens. The selection is pre-initialized with the last
used memory card directory.
Note: The file selection box also has a Write protected check box to insert a write protected virtual
memory card.

EIO0000001714 12/2018 63
Menu Commands

Step Action
3 Proceed with one of the 2 following possibilities:
 Use the preinitialized directory.
Result: The last removed memory card is inserted.
 Select another directory.
Result: Another memory card (for example different in content or empty) is inserted.
Result: The CARDERR LED turns off.
4 Reset the system bit %S65 (CARDIS).
Result: The virtual front plate shows a memory card and the Card Acc LED goes on.

Since a directory and its content represent the memory card, exchanging the content of the
directory can simulate the exchange of a memory card. This can be done by normal Windows
means (cut/copy/paste of files or renaming/moving folders).

Memory Card Full

By default the memory card is not full at simulator start.
Since there is no size tracking, at any time it is possible to simulate that the memory card is full.
This is done by opening the context menu (right-click the memory card) and selecting the menu
command Memory Card Full.
After this menu command is selected:
 New data writing is not possible.
 Read accesses are possible.
 Overwrite actions are possible.

This state is indicated by the check mark in the context menu command.

Write Protection
By default the memory card is not write protected at simulator start.
At any time, it is possible to simulate that the memory card is write protected.
This is done by opening the context menu (right-click the memory card) and selecting the menu
command Write Protection.
After this menu command is selected:
 Data writing is not possible.
 Read accesses are possible.

This state is indicated by the check mark in the context menu command.
Control Expert adds some restrictions linked with the memory card (for example program
modification is forbidden if the card is write protected). The simulator supports these restrictions
too.

64 EIO0000001714 12/2018
 Menu Commands

To simulate the write protection feature the following system bits and words are supported by the
simulator:
 %S65 (CARDIS)
 %S96 (BACKUPPROGOK)
 %SW97 (CARDSTS)

NOTE: It is not possible to access the files via an FTP client through the simulator since the files
are directly accessible by Windows features.

EIO0000001714 12/2018 65
Menu Commands

Simulator Control for Modicon Momentum CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon Momentum family.
Representation of the dialog box:

CPU Front Plate

The RUN display is always on, green when a project is loaded in the simulator.
The SER COM display is flashing yellow when data is exchanged between Control Expert (or other
clients) and the simulator.
The other grayed displays of the front plate are not supported by the simulator.

Card Acc and Memory Card

The Card Acc and memory card are represented but they do not concern Modicon Momentum
CPUs.

Reset
The Reset button is represented but it does not concern Modicon Momentum CPUs.

66 EIO0000001714 12/2018
 Menu Commands

Power Cycle
With this button, you simulate a warm start of the CPU. It means that the connection between
Control Expert and the simulator is broken, the current project variables remain and the simulator
goes into the state RUN (autostart active) or STOP (autostart deactivated).
A power cycle corresponds to a power off and power on of a real power supply.

Simulation
Dialog box fields:
Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.
Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.
Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP with
the host PC of the simulator (see page 15)). The DNS name and TCP/IP address are shown for
each client.

EIO0000001714 12/2018 67
Menu Commands

Event Dialog

Introduction
You can open and close the event dialog with
 the menu command Event dialog in the context menu of the simulator symbol in the task bar or
the simulator symbol
 the command button Events in the simulator dialog (only open)

This dialog is not available for safety PLCs.

Selection Condition
The menu command and the command button are enabled if IO events are defined in the project
currently loaded, i.e. if the project uses event tasks.

Representation
Event dialog:

EVT0 Event
Possible events for the EVT0 task are shown here. This user task has the highest priority in the
system and can only contain one IO event.
If this task is part of the project, the event command button is enabled.

EVTi IO Event
Possible events for the EVTi IO task are shown here. The maximum number of tasks depends on
the PLC simulated.
The event command buttons are enabled according to the number of events defined in the project.

68 EIO0000001714 12/2018
 Menu Commands

Clear

Introduction
With Clear, you can remove the currently loaded project from the simulator memory and put the
simulated PLC (and the simulator) into NOCONF status.
This corresponds to a cold start of the PLC without valid project loaded (the connection between
Control Expert and the simulator is broken).
You can execute Clear with the menu command Clear in the context menu of the simulator symbol
in the task bar.

EIO0000001714 12/2018 69
Menu Commands

Reset

Introduction
With Reset, you can reset the simulated PLC (and the simulator). This corresponds to a cold start
of the PLC (the connection between Control Expert, the simulator is broken, project variables are
reset and the simulator goes in RUN (if auto start is activated) or in STOP (if auto start is
deactivated)).
Reset corresponds to the reset button on a real CPU.
You can execute reset with
 the menu command Reset in the context menu of the simulator symbol in the task bar or the
simulator symbol
 the command button Reset in the simulator dialog.

NOTE: %S0 is not set to 1 using Reset with the PLC simulator (in contrast to a real PLC).

70 EIO0000001714 12/2018
 Menu Commands

Power Cycle

Introduction
With Power Cycle, you execute a power cycle (power off/ power on) for the simulated PLC (and
the simulator). This corresponds to a warm start of the PLC (the connection between
Control Expert and simulator is broken and the current project variables remain).
A power cycle corresponds to the reset button of a Premium power supply or the unplugging and
plugging in of a power supply.
You can execute a power cycle with
 the menu command Power Cycle in the context menu of the simulator symbol in the task bar or
the simulator symbol
 the command button Power Cycle in the simulator dialog

NOTE: In case of a safety PLC, power cycle simulates a cold start. Project variables are reset.

EIO0000001714 12/2018 71
Menu Commands

Options

Description
In this dialog box, you can define special settings for the simulator.
You can open the dialog with the menu command Options in the context menu of the simulator
symbol in the task bar or the simulator symbol.

Representation
Options

Always on Top
If you activate this check box, the simulator control window is always on top of other dialog boxes
and windows.

Only PLC Front

If you activate this check box, the simulator control window is minimized and only the virtual front
plate of the PLC is shown.

Sound
If you activate this check box, the simulator plays a sound in the following situations:
 Starting and exiting the simulator.
 Error in project.

Use default application to start simulator (enforce security)

If you activate this check box, the simulator needs an application with password to start
(see page 13).

Starting Application with password

Path and name of the application with password used to start the simulator.

72 EIO0000001714 12/2018
 Menu Commands

Timing (simulator)

Description
With this menu command, you can open and close the timing dialog box. This dialog box shows
simulator statistics for CPU use, process priority and user scan time. Additionally, you can change
the priority and the sleep time in this dialog box, to optimize simulator timing and adjust the PC
load.
Representation of the dialog box

The dialog box consists of 4 main areas:

 Processor Load, page 74
 Priority of the Simulator, page 76
 Data in the User Task, page 77
 Minimal Sample Time, page 78

EIO0000001714 12/2018 73
Menu Commands

Processor Load

Introduction
The processor load (on the PC) caused by the entire simulation and the individual user tasks is
shown here.

Process
This bar graph shows the actual processor load caused by the simulator process in percent.
Unlike the display in the Windows task manager which only indicates the current value, this bar
graph indicates the average value over the time shown at the end of the bar graph.
The time entry at the end of the bar graph is the time that has passed since the simulator was
started or since the last time reset was pressed.

Overhead
This bar graph shows the average processor load caused by the simulator process overhead in
percent.
The overhead is calculated as follows:
load caused by the entire process - load caused by the user tasks
This can be an absolute or relative value for the processor load caused by the simulator. This
setting can be made in the Display area.
The time entry at the end of the bar graph is the time that has passed since the simulator was
started or since the last time Reset was pressed.

Mast ... Evt1T

The bar graph shows the average processor load caused by the individual user tasks in percent.
These can be absolute or relative values for the processor load caused by the simulator. The
representation method can be set in the Display area.
The option button at the beginning of the bar graph can be used to select a user task. The details
for this user task will be displayed in the Data in the user task area.
The time entry at the end of the bar graph is the time that has passed since the individual tasks
were started or since the last time Reset was pressed.
NOTE: In case of a safety PLC, only the Mast task is enabled

Display: Absolute
If you activate this option button, the actual value is shown in the bar graph. This is shown as a
percentage of the entire processor load for the PC.

74 EIO0000001714 12/2018
 Menu Commands

Display: Relative
If you activate this option button, the relative processor load is shown in the bar graph. This is
shown as a percentage of the processor load caused by the simulator.

Reset
If you press this command button, time measurements in this area are reset.
This is required to achieve a consistent representation of the times which have passed because
the individual times are not started simultaneously when opening the simulator.

EIO0000001714 12/2018 75
Menu Commands

Priority of the Simulator

Introduction
In this area, you can define the priority of the simulator process.
It may be necessary to assign a high priority to the simulator because the cycle times of the
individual user tasks can deviate greatly if there is a heavy load on the PC. These deviations are
directly caused by the Windows operating system and can reach 100 ms with Normal priority. In
most cases, the watchdog timer is also affected. In this case, setting the simulator priority higher
can prevent the watchdog from being triggered.

Real-time
In this priority, user task cycle times only deviate by a few milliseconds.
NOTE: This priority should be used with care because the simulator has the highest possible
priority in this case and interrupts the Windows system. If you use this priority with a very small
sleep time and a cyclic user task, the PC may cease proper operation.

High
In this priority, user task cycle times normally do not deviate by more than 10 ms.

Normal
In this priority, user task cycle times can deviate up to several 100 ms.

Low
This priority quickly causes the watchdog to be triggered and should only be used on a PC with
nearly no load.

Apply
If you press this command button, settings in this area are applied and used immediately.

76 EIO0000001714 12/2018
 Menu Commands

Data in the User Task

Introduction
2 histograms are shown in this area
 the cycle time histogram for the selected user task
 the sleep time histogram for the selected user task

Structure of the Histograms

The histograms automatically adjust their ranges to the current values.
The percent scale (y-axis) is adjusted to the maximum percent value.
If a new value is not in the range for the time scale (x-axis), the range is increased by a factor of 2
until the new value is in the range. In this case, the previous values are recalculated for the new
range.
If a value occurs so seldom that it does not create a peak in the histogram, then a one pixel peak
is created so that the value can be seen.

Cycle time
This histogram shows the relative frequency of cycle time values in the user task currently
selected. See also Minimal Sample Time, page 78
The counter to the left under the histogram counts the number of cycles in RUN mode represented
in this histogram.

Sleep time
This histogram shows the relative frequency of sleep time values in the user task currently
selected. See also Minimal Sample Time, page 78
For cycle tasks, normally a single value is shown with 100 %. This is the minimum sleep time for
user tasks. If you change the value for the minimum sample time, a second peak is created for the
new value.
User tasks cycles are included in this histogram (regardless of the PLC mode).

Cycle Counter
The counter to the left under the histogram counts the number of cycles in RUN mode represented
in the cycle time histogram.
This counter has no meaning for the sleep time histogram because cycles are included there
(regardless of the PLC mode).

Reset
If you press this command button, the histograms for the user task currently selected is reset and
a new statistic is started.

EIO0000001714 12/2018 77
Menu Commands

Minimal Sample Time

Description
The simulator is not the only thing running on the PC, therefore the other programs must be given
a chance to be executed. Therefore the user task is assigned a fixed sample time.
The sample time is calculated according to the following formula:
Sample Time = Cycle Time + Sleep Time.
Time of the user task

Legend

Time Meaning
Sample time Time which is made available for running the user task.
Cycle time Time which is actually required for running the user task.
Sleep time Time in which the other programs on the PC can be executed.

Minimum sample time (ms)

A minimum sample time of 10 to 100 ms can be set. The smaller the sample time you select, the
smaller the sleep time (sleep time = sample time - cycle time) and therefore the more loaded the
PC is.

NOTICE
LOSS OF PC OPERATION
Do not use a small sample time when selected in combination with a high simulator priority and
cyclic user tasks.
Failure to follow these instructions can result in equipment damage.

Apply
If you press this command button, the minimum sample time is applied to the selected user task
and used immediately.

78 EIO0000001714 12/2018
 Menu Commands

Info

Description
With this menu command, you can open and close the info dialog box. This dialog box shows the
current version of the simulator and its components.

EIO0000001714 12/2018 79
Menu Commands

Help

Description
With this menu command, you can open the online help for the simulator.

80 EIO0000001714 12/2018
 Menu Commands

Ending the Simulation

Description
With this menu command, you can exit the simulator.

EIO0000001714 12/2018 81
Menu Commands

82 EIO0000001714 12/2018
 EcoStruxure™ Control Expert
Index
EIO0000001714 12/2018

Index

D
dialog boxes, 37

M
menu commands, 37

S
simulating a PLC, 11
simulation, 11

EIO0000001714 12/2018 83
Index

84 EIO0000001714 12/2018